Description
Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including (1) thumstbl.php, (2) wpfiles.php, and (3) wallpapr.php.
References
- picturedis-lang-file-include(27183) vdb-entry
- 20060615 PictureDis Products "lang" Parameter File Inclusion Vulnerability mailing-list
- 26502 vdb-entry
- 18471 vdb-entry
- ADV-2006-2352 vdb-entry
- 26500 vdb-entry
- 1016279 vdb-entry
- 26501 vdb-entry
- 20656 third-party-advisory